Microsoft Outlook

Microsoft Patches 1,094 Vulnerabilities Including Exploited Outlook Zero-Day CVE-2026-124194

Microsoft’s November 2026 Patch Tuesday release addresses a total of 1,094 vulnerabilities across its product portfolio. Among them is CVE-2026-124194, an Outlook spoofing zero-day that has already been exploited in the wild. The flaw allows an attacker to send a specially crafted message file that tricks users into opening it, causing Outlook to connect to an attacker-controlled server and disclose NTLMv2 hashes without showing the usual external-content warning. Microsoft rates the issue as moderate with a CVSS score of 6.5 and confirms it cannot be triggered through the Preview Pane. The update also covers 726 Windows flaws, 174 Office issues, and dozens more in SQL Server, SharePoint, Azure, and Exchange Server. This release marks the final monthly security updates for Windows 11 version 23H2 Enterprise and Education editions.

Microsoft November 2026 Patch Tuesday Fixes Record 1,235 Vulnerabilities Including Actively Exploited Outlook Zero-Day

Microsoft released its November 2026 Patch Tuesday updates addressing a record 1,235 vulnerabilities, including one actively exploited zero-day in Microsoft Outlook. The updates cover 66 Critical flaws, with 48 Remote Code Execution issues and multiple Elevation of Privilege vulnerabilities across Windows components and Microsoft Edge. The zero-day CVE-2026-124194 allows attackers to spoof messages that force Outlook to connect to attacker-controlled servers and leak NTLM hashes without user warnings. Approximately 639 flaws affect Windows products, while other vendors including Cisco, Google, Ivanti, SAP, and SonicWall also issued November security updates. Microsoft continues leveraging AI-driven vulnerability discovery following the previous month's record of 1,411 flaws.